{"generated_at":"2026-10-23T15:00:26.408Z","count":2,"incidents":[{"id":"mlflow-server-side-request-forgery-vulnerability-cve-2026-64849","url":"https://pwned.coffee/i/mlflow-server-side-request-forgery-vulnerability-cve-2026-64849","title":"MLflow Server-Side Request Forgery Vulnerability","summary":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19 (federal deadline 2026-09-02).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"MLflow MLflow","fixed_versions":[],"ids":["CVE-2026-64849"],"stack":["ml-infra"],"first_seen":"2026-08-19T12:00:00.000Z","updated_at":"2026-08-19T12:00:00.000Z"},{"id":"ray-project-ray-code-injection-vulnerability-cve-2025-62593","url":"https://pwned.coffee/i/ray-project-ray-code-injection-vulnerability-cve-2025-62593","title":"Ray-Project Ray Code Injection Vulnerability","summary":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17 (federal deadline 2026-08-20).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ray-Project Ray","fixed_versions":[],"ids":["CVE-2025-62593"],"stack":["ml-infra","apple"],"first_seen":"2026-08-17T12:00:00.000Z","updated_at":"2026-08-17T12:00:00.000Z"}]}